Dealing with the COVID-19 crisis, federal regulators are easing policies related to some medical gear that's in high demand but in short supply. But what are some of the potential security and privacy issues in the near term and in the big picture? I'm Marianne Kolbaskak-McGee, Executive Editor at Information Security Media Group, and today I'm speaking with technology attorney Stephen Tappler of the law firm Mendelbaum-Salsberg PC. So, Stephen, as the nation combats the COVID-19 outbreak, President Trump said he recently invoked the Defense Production Act, giving him authority to order manufacturers to produce needed medical equipment and supplies.
In the meantime, some manufacturers, including General Motors and Ford, have reportedly volunteered to produce such products, including ventilators. Also, the Food and Drug Administration has issued new policy allowing manufacturers of certain FDA-cleared non-evasive vital sign measuring devices to expand their use so that healthcare providers can use them to monitor patients remotely. While the priority is obviously to get these medical devices quickly to the places and patients that need them, what do you see as some of the potential security and privacy issues that the healthcare sector could face in the bigger picture or even in the short term in the rush to get these products out to the patients and entities that need them? So, the word that you use that is most concerning is remote, and anything that is now converting from an on-site to a remote process is fraught with the usual what risk assessments have been taken to evaluate the vulnerabilities that might be associated with that remote process, and whether it's employees or whether it's people who take orders.
If you're taking, think about taking orders from home, if you're using a home computer, and the home computer is using Windows 7, which is no longer supported by Microsoft, you may be injecting problems if there's a vulnerability in that computer because your child has been using it for some game that has been infected with malware. You may be infecting malware into the supply chain, unwittingly, unknowingly. And multiply that by many, many, many, many, tens of thousands, and you can see the problem that's taking place. Now, some companies have taken measures and have instituted policies and processes way in advance for events like this, you know, business continuity, disaster recovery, those types of plans.
But by and large, this has been an issue that has only begun to make people realize that the migration to virtualization is both a blessing and a curse. And, you know, and being forced into it without taking the appropriate precautions is very dangerous. And by the way, about the Defense Production Act, as of this morning when we're speaking, this is Monday morning, the 23rd of March, I have not seen, and this is me, I've not seen any orders directing production from the administration other than voluntary compliance or voluntary actions by companies such as GM. So, Stephen, when it comes to companies that maybe will even volunteer to make medical products, General Motors supposedly making ventilators, what sorts of potential security, privacy, and maybe patient safety issues are we looking at as these companies sort of, you know, reconfigure their production lines for these sensitive products that may or may not be connected, depending on what the environment might be?
Internally for in-company issues, you may have a retooling to a certain product line or a different product line but not have the associated security that you've already built into your current product line security supply chain built in. And, you know, in the rush to have something done, and it's a laudatory activity to say, yeah, we're going to ramp up, we're going to start providing masks and ventilators and what have you. If you lose the security along the way, you may be injecting more problems than you solve. I mean, what with the amount of phishing that's going on and the amount of COVID fraud that's being attempted on all levels, and especially in the healthcare industry, you're looking at the potential for virus attacks in a totally different universe, in the digital universe.
One thing to keep in mind is that if you are using devices which are smart, we're looking at additional risk vectors and threats that will probably be, in all likelihood, be overlooked or not addressed immediately, such as from a privacy perspective and perhaps other perspectives. You have this digital thermometer that I think now you have to wait two weeks to be able to get one, made by a company, I believe, in China or Japan. And it is a, it sends your temperature to the government, and the government can track the amount of high temperature or out-of-band higher temperature people within a certain geographic area. The problem is you have to register with this company, giving your name, your birthdate, and all this other information.
Who knows where that information is going to go? And as they collect millions and millions of people, they become the honeypot for attack. So the virus and its effects have had incredible ripples in the technology world and especially when it comes to security mindfulness. And Stephen, what about the actual ventilators and other related products that might be kind of rushed out right now, whether it's from, again, manufacturers that don't generally make medical devices.
You know, we hear so much about even the medical device makers themselves having had issues with products because, you know, there might be vulnerabilities there that are easily hacked. Are there certain considerations that, you know, will have to be kind of put on the back burner here when it comes to privacy and security just to get some of these products out there and then let's worry about those issues later? This is an ongoing tension. And you're talking about life-sustaining life versus sustaining health versus privacy issues.
And the argument being, well, would you rather be healthy and have your information subject to potential exploitation or protected from disease, or would you rather very, very much keep your information private and expose yourself? I'm not sure that that's necessarily a valid argument or a valid balance point because we have had so much development in the field of security, in the field of cybersecurity, both physical and cybersecurity, that this should be inbuilt. And we've been arguing about this. You and I have spoke about this many times in the past.
This is not new. Building security is not new. If you're going to roll out a new car and you're going to rush a new car into production, you're not going to forget to put a seatbelt in the car. You're not going to say, well, we've got to get out real quickly.
Forget about the seatbelt or let's make the seatbelt out of defective material so that it'll break if any pressure is put on it. So I think that the idea of leaving security behind for in either the development and the coding of these devices that are made by computers, right? They're not going to, in large part, be handcrafted. And to the extent that any computerized information is going to be used in the creation, the distribution, or any part of the logistics chain, one has to think and keep in mind hand-in-hand security implications.
There's just no way of escaping it. So I think that the privacy issues of the risk to privacy argument is important. The risk to safety argument versus risk to privacy is really, it's a fallacious argument because security should already be built in and there should be attention paid to it. Now, the U.S.
has also eased up on some of their HIPAA requirements as it applies to telehealth as the nation deals with COVID-19. And the Department of Health and Human Services has also issued other HIPAA-related waivers as we deal with this crisis. Looking at the big picture, as the nation institutes these sudden policy and regulatory changes, what other potential issues do you think there could be when it comes to security of devices, privacy of patient data? Do you think there will be sort of a mess to clean up later on?
What do you kind of foresee might be the outcome of all this, you know, after the worst is over in terms of dealing with the actual outbreak? There are a few perspectives to take here. One is you need to get information out to people. You need to be able to diagnose them as quickly as possible in order to help what experts are calling flatten the curve and prevent the increase in the spread of the virus.
And that's laudable. The issue here is when you do that, when you are, again, where you're rushing to get these things out to market, the relaxation in the regulations and HIPAA is not a relaxation in security. It's a relaxation in the ability to conduct telemedicine, for example. So if you're conducting telemedicine, you're a physician conducting telemedicine from a Windows 7 machine, again, I use it as an example.
Will you be excused from HIPAA security and privacy and integrity requirements? Maybe. Maybe it'll be an exigent circumstance where you'll be forgiven for it. But certainly, do you want to be the test case for that?
Because there will be numerous, if not a huge amount of instances, again, this is just my opinion, in which the relaxation will be taken as a license not to take care of security. And I don't think that any relaxation permitted by the government is going to permit a relaxation in security. There may be, who knows, the government may preempt and decide to shield legally from liability. But I haven't seen that yet.
I know there is a push there are a push from some sectors to provide immunity during this period of time. Again, we have to see how the legislation and the rules and regulations evolve, and they'll evolve probably pretty quickly. And finally, Stephen, we're in a very fast-moving, fast-changing sort of situation here. Any other top privacy or security-related issues that you see right now with the whole COVID-19 situation that we haven't touched upon?
A couple of points I think are important to keep in mind. If you are remoting, if you are operating a computer in a new environment, there will be new threats to that environment because of the introduction of your workspace into that